Back to skill

Security audit

job-analysis-future

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language study helper for a job-analysis textbook chapter, with no executable code, persistence, credential access, or hidden data flows.

Install this if you want Chinese-language study support for this specific job-analysis chapter. Users who need another language may need to ask the agent to translate or adapt responses, but no security-sensitive behavior was found in the artifact.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file presents its instructional content entirely in Chinese, including the usage guidance sections, but does not indicate that the language choice is optional or limited to a region-specific audience. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown content is written primarily in Chinese while embedding substantial English terminology, and it does not state that the skill is intended only for Chinese-speaking users or offer an alternative language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents its instructional content entirely in Chinese while mixing in English technical terms, but it does not state that the skill is region-specific or give users an option to choose language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L28 instructs the skill to answer in Chinese because the user is currently using Chinese. This imposes a language choice by default rather than explicitly offering the user a language preference, which can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown content is written primarily in Chinese while repeatedly embedding English terminology, and it does not indicate that the user opted into this language/locale format. Under the policy for natural-language issues, forcing a specific language without user choice can be a locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file is largely written in Chinese but repeatedly embeds key instructional content and terminology in English, such as descriptors, roles, competencies, and selection criteria. Under the policy for natural-language issues, forcing a specific mixed language/locale presentation without user opt-in can be considered a language policy concern when no justification or alternative is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown content presents core instructions and study guidance in a mixed Chinese-English form, which effectively imposes a language/locale format on the user without opt-in. The policy for this audit flags language or locale constraints when the skill does not explicitly offer a choice or justify the locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.